Relay Modern allows co-located queries with components. I don’t understand your concerns about performance or security. GraphQL should only expose the fields y

Relay Modern allows co-located queries with components. I don’t understand your concerns about performance or security. GraphQL should only expose the fields you can fetch in a fast and safe way. Optimise the field lookups; not the whole query execution. A deeply nested GraphQL request is no worse than a series of REST fetches.